Conversation
Watermark-based revocation (per-user revoked-before timestamp in Redis) instead of a per-token blacklist. Login and RefreshToken enforce the watermark; AccessTokenRevocationEvaluator added with unit coverage.
…paths Same-transaction synchronous projection (Application port + Infrastructure implementation) wired into 11 membership write paths: registration, account and workspace provisioning, invitation acceptance, member add/activate/ suspend/remove/role change, ownership transfer, workspace creation. - AccessGrant.Activate restores a revoked grant; partial unique account-level index ux_access_grants_account_user_account_level added - InitDb seeds account-level grants alongside workspace grants - Migration consolidation: single SchemaV2Baseline carrying the strict idempotency constraint and the new grant index; incremental migration files removed - Application-level tenant-spoofing proof: TenantBootstrapBehaviorTests - Integration proof: AccessGrantProjectionTests + RlsRuntimeEnforcementTests (runtime grant write enforced under the notrelix_app role) - Full solution suite: 4251/4251 passing across 7 test projects
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 36191817 | Triggered | Generic High Entropy Secret | dec54c9 | backend/tests/Notrelix.Infrastructure.Tests/Identity/Mfa/MfaTotpServiceTests.cs | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
…h re-authentication - Step-up policy IA-SEC-002: MFA|password|OAuth proof required for DisableMfa, RegenerateRecoveryCodes, OAuth link/unlink - SecurityStepUpService with single-use proof bound to user+session+purpose - Session management: list, revoke-by-id, revoke-others; JWT sid claim - OAuth step-up flow with flow-bound callback dispatch (PeekAsync)
New endpoints: security step-up (requirement/complete-mfa/complete-password), sessions (list/revoke/revoke-others), OAuth step-up start/callback. Updated bodies: DisableMfa, RegenerateRecoveryCodes, UnlinkOAuth carry StepUpToken; StartOAuthLink accepts stepUpToken query.
… from DI The registration references IResourceAuthorizationSnapshotStore types owned by a parallel workstream whose files are not yet committed, breaking the build.
…LK-001..004) - Add GetDeleteAsync to IRedisCacheService with atomic Lua consume that matches Microsoft RedisCache hash entry format (WRONGTYPE fix) - Rename challenge Redis logical key prefix to identity:mfa:challenge: - Add ChallengeId to MfaChallengePayload, generated by MfaChallengeFactory (v7) - Add ChallengeMaxAttempts=5 + ChallengeVerificationRatePolicy to MfaPolicy - CompleteMfaChallenge: purpose gate (PasswordLogin/OAuthLogin only), multi-attempt with rate limit, revalidate after atomic consume - SecurityStepUpService: separate StepUpProofStore, rate limiting, multi-attempt, post-consume revalidation, proof issued via proof store - Add IStepUpProofStore + StepUpProofStore (Infra) + InMemory fakes - Add blocker regression tests: replay rejection, wrong purpose/session/user, concurrency single-winner, attempt limit invalidation, purpose isolation
…acts (IA-SEC-001..005) - ChangePassword: optional StepUpToken consumed (purpose ChangePassword) only when user has active MFA; wrong current password never burns a valid proof - Add SessionRevocationReasons stable vocabulary (Domain) and populate reason in ChangePassword/ResetPassword/DisableMfa/RevokeSession/RevokeOtherSessions/Logout - API: optional StepUpToken on ChangePasswordRequest/endpoint - Tests: Application step-up matrix (missing/invalid/valid proof, no-burn, no-MFA ignores token), Domain reason propagation into UserSessionRevokedDomainEvent, Integration ChangePassword step-up matrix on real PG+Redis (9.5 cases incl. raw-challenge rejection with no side effect and proof reuse after wrong password)
…dow-bucket flake; derive RFC6238 test secret at runtime
… revocation, listing
Phase 12 (IA-TOK-001..009):
- CreateApiTokenCommand: session-required, single-use step-up proof (IssueApiToken
purpose), name 1..256, future-only expiration, raw secret returned exactly once
- ApiTokenSecretService: ntk_v1. prefix + 32-byte CSPRNG URL-safe secret,
SHA-256 digest persisted via TokenHasher, max 512 input bound
- ApiTokenAuthenticationHandler: opt-in "ApiToken" scheme, digest lookup in
system context, fail-closed on unknown/revoked/expired/user-less, RecordUse
- RevokeApiTokenCommand: immediate revocation, NotFound on id/workspace mismatch,
semantic no-op when already revoked
- ListApiTokensQuery: metadata-only, ordered by CreatedAt desc, implements
IWorkspaceRequest/IQuery/IRequirePermission (no allowlist additions)
- Endpoints: GET/POST/DELETE under /api/v1/workspaces/{workspaceId}/api-tokens,
authenticated + ManageWorkspaceSettings on workspaces.workspace
- RLS: api_tokens policy switched from user-owned to workspace-scoped
(ops.apply_scoped_business_policies) in 006_policies_identity.sql
- Tests: ApiTokenHandlerTests 10 application scenarios; ApiTokenFlowTests 5
integration scenarios on real PostgreSQL+Redis (create round-trip, unknown/
garbage/expired rejection, immediate revocation); Architecture 372, Application
649, Domain 2576, Infrastructure 120, Platform 147, API 230 all green
…ice and regenerate OpenAPI - handler ctor takes IApiTokenSecretService (single DI descriptor); concrete ApiTokenSecretService was not resolvable by AddScheme activation - regenerate contracts/openapi/notrelix.v1.json: workspace api-token endpoints (Identity.ApiTokens.List/Create/Revoke), additive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.